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Abstract — We demonstrate a new construction for perfect 
quantum secret sharing (QSS) schemes based on imperfect 
"ramp" secret sharing combined with classical encryption, in 
which the individual parties' shares are split into quantum and 
classical components, allowing the former to be of lower dimen- 
sion than the secret itself. We show that such schemes can be 
performed with smaller quantum components and lower overall 
quantum communication than required for existing methods. 
We further demonstrate that one may combine both imperfect 
quantum and imperfect classical secret sharing to produce an 
overall perfect QSS scheme, and that examples of such schemes 
(which we construct) can have the smallest quantum and classical 
share components possible for their access structures, something 
provably not achievable using perfect underlying schemes. Our 
construction has significant potential for being adapted to other 
QSS schemes based on stabiliser codes. 



I. Introduction 

Quantum secret sharing (QSS) is a cryptographic protocol 
in which a dealer encodes a quantum state (the secret) into 
multiple shares and distributes the shares to various players. 
Certain subsets of the players (denoted "authorised" sets, and 
collectively known as the access structure) can collaboratively 
reconstruct the secret from their shares while other subsets 
(denoted "forbidden" sets, and collectively known as the 
adversary structure) can obtain no information about the secret 
from their shares. An example would be an n-player protocol 
where the access structure consists of all sets of k or more 
players and the adversary structure of all sets of A; — 1 or 
fewer players. Such protocols are known as {k, n) threshold 
schemes. Analogous classical secret sharing (CSS) protocols 
(involving classical secrets and shares) were introduced by 
Shamir |1| and independently by Blakley IS). QSS protocols 
were originally described by Hillery, Buzek and Berthiaume 
Ul and Cleve, Gottesman and Lo 14|, with the latter giving 
a means to construct a threshold scheme for any allowable [J 
access structure. 

Threshold schemes are examples of "perfect" access struc- 
tures, i.e. those in which every subset of players is either au- 
thorised or forbidden, with no subsets able to reconstruct only 
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' QSS protocols must satisfy the two criteria of monotonicity (an authorised 
subset remains authorised if shares are added) and the no-cloning theorem 
(two disjoint subsets cannot both be authorised, since then the players could 
separately reconstruct two copies of the secret, violating no-cloning) 



partial information about the secret. As proven by Gottesman 
f5\, perfect QSS requires that all player shares (aside from 
trivial shares whose presence never affects whether or not a 
subset is authorised) be at least as large as the secret. That 
is, for a secret of dimension dg, and players i each receiving 
a share of dimension di, perfect QSS requires min^ di > dg, 
with "optimal" schemes achieving di — dg for all i. 

This bound imposes a large potential cost on the communi- 
cation and storage of shares in perfect QSS. For example, 
sharing a 1-qubit secret by distributing quantum shares to 
100 players in a threshold scheme will require at least 100 
qubits to be communicated by the dealer and (due to the 
no-cloning bound) at least 51 qubits to be used by the 
players for reconstruction. This may well not be practical 
given noisy quantum communication channels, unreliable joint 
quantum operations, and short storage times. Furthermore, no 
optimal general construction for schemes with non-threshold 
perfect access structures is known (they may be non-optimally 
constructed by concatenating threshold schemes ||5l), so the 
costs for such schemes may be larger still. 

In this paper we demonstrate a new class of protocols 
which reduce the cost of quantum communication and storage 
in implementing perfect QSS schemes, by combining two 
existing ideas for doing so: ramp (i.e. non-perfect) secret 
sharing |l6l and hybrid secret sharing JTl, El. Our protocols, 
involving both classical and quantum shares, require a smaller 
amount of total quantum communication than either approach 
taken in isolation. Moreover, we describe protocols that are 
provably optimal in minimising both the size of the quantum 
shares and, given this minimisation, the size of the classical 
shares required. 

II. Ramp secret sharing 

The derivation of the share size bound in ||5| (which we dis- 
cuss in more detail in Section [V| depends on the observation 
that, for a perfect QSS, there must exist some forbidden subset 
which can be made authorised by adding a single additional 
share. Thus complete information about the secret of size dg 
may be transferred via a share of size di, from which the 
bound follows. 

Consider now an access structure in which every forbidden 
subset instead requires a minimum of L shares to be added to 
become authorised: the corresponding bound would be (in the 
simplified case where all shares are of the same dimension di) 
that Llogjdi > log2 (is- There would also now exist certain 
intermediate subsets (consisting of some forbidden subset with 
I < L shares added) who could reconstruct some partial 
information about the secret. Thus, one could potentially have 
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smaller shares (encoding e.g. an s-qudit secret into shares of 
size s/ L qudits), but at the cost of some security; there will be 
some information leakage to subsets who are not authorised. 

Such schemes are known as "ramp" secret sharing and 
were originally proposed for CSS ||9l, (UPl for which an 
analogous share size bound exists (and can lead to very 
large data storage requirements for perfect schemes), and one 
can formalise whether or not such leakage is tolerable by 
considering a computationally-bounded adversary. Ramp QSS 
(RQSS) schemes have received relatively Uttle attention in the 
literature, but a construction has been given by Ogawa et al. 
for all allowable (fc, L, n) threshold access structures i.e. 
where subsets of k or more players are authorised, those of 
k — L or: fewer are forbidden, and those of k ~ I {I < L) are 
intermediate (so a perfect threshold scheme in this notation 
has L = 1). Furthermore, the construction of ||6| is optimal in 
that it encodes a secret of L qudits into shares of a single qudit 
(though we note that, like the protocol of |4| upon which it is 
based, this protocol additionally requires the qudit shares to be 
of prime dimension d > n, and hence not all ramp threshold 
schemes are covered by this construction). 

III. Hybrid secret sharing 

In addition to being applicable to perfect schemes only, 
the share size bound for QSS does not require that every 
share be a quantum system i.e. some shares can potentially 
consist partly or solely of classical information. While strictly 
speaking such shares can still be regarded as quantum systems 
and must still obey the size bound, they would clearly have 
great practical advantages, since classical information is far 
easier to communicate, store and process, and they would 
allow QSS schemes to involve players with no ability to handle 
quantum states. Such schemes can be implemented through 
combining QSS with classical encryption. 

In the well-known quantum teleportation protocol IfTTI . 
Alice transmits an unknown quantum state tp to Bob (with 
whom she shares a maximally-entangled state) via a local 
measurement on her joint quantum system followed by the 
transmission of some classical information C to Bob (who then 
performs a state reconstruction conditioned on C). Bob's local 
quantum system can therefore, immediately prior to receiving 
the information, be represented as being in some mixed state 
Pb which must be independent of ijj due to the no-signalling 
theorem, but from which, in combination with C, ip can be 
reliably obtained. In other words, one can consider ps as 
being the state ip securely encrypted using a classical key C. 
Specifically, it follows from the teleportation protocol that one 
can securely encrypt a quantum state of dimension d using 
a classical key of 21og2 d bits (which has also been shown 
llT2l to be the minimum key size required), via the basis-state 
encryption: 

\j) Lu^^\j + k mod d) (1) 

where w — and the two values {fc, Z} g {0 . . . d} (chosen 
at random and thus independent of the original state) constitute 
the classical key (CK) for the encrypted quantum secret (EQS). 

Such encryption can be exploited in QSS, as demonstrated 
in IJI, which effectively described (in terms of teleportation) 



a scheme in which the dealer sends one player the EQS and 
the other the CK. Neither player alone has any information 
about the secret but together they may reconstruct it, thus 
constituting a perfect (2, 2) threshold scheme in which one 
share is the size of the secret but the other is wholly classical. 
Though not discussed in terms of communication cost in [3|, 
this halves the amount of quantum communication required 
vs. a standard optimal QSS. 

This idea was generalised by Nascimento, Mueller-Quade 
and Imai [7], who considered the case of such "hybrid" QSS 
(HQSS) schemes where the EQS and CK are separately en- 
coded using QSS and CSS schemes respectively, and then the 
classical and quantum shares distributed to the players. They 
gave a general construction for hybrid schemes; we rephrase 
its specific application to the case of threshold schemes in the 
following lemma. 

Lemma 1. ill A hybrid (fc, n) threshold QSS can be con- 
structed using only (2n — 2fc + 1) fully- or partly-quantum 
shares with the remaining shares fully classical. 

Proof: The construction consists of the dealer classically 
encrypting the secret, dividing the EQS among a subset of 
Uq < n players using a {kq,nq) QSS, and the CK among 
all n players using a (fc, n) CSS (so some players have both 
classical and quantum shares). Thus fc — 1 or fewer players 
will have no information about the CK and hence none about 
the secret (irrespective of any quantum shares they may also 
have), fc or more players will be able to reconstruct the CK but 
we further require that they be able to reconstruct the EQS, 
and hence have kq or more quantum shares, fc players will 
have a minimum of fc — {n — rig) quantum shares, hence we 
require 

Uq ~ kq > n ~ k. (2) 
To satisfy no-cloning, we additionally require 

Uq < 2kq - 1. (3) 

From ^ and ^ we obtain 

Uq > 2n - 2fc + 1 (4) 

and minimising Uq by setting riq = 2n — 2fc + 1 we achieve 
the result. Note that due to no-cloning n > {2n — 2fc + 1) 
and hence in general this construction reduces the number of 
quantum shares required vs. a non-hybrid scheme. ■ 
Some observations about this protocol: we note that for 
Uq — 2n - 2k + 1, it follows from Q and Q that 

Uq — 2kq — 1 and (5) 

Uq — kq = n — k. (6) 

for which there is only one solution for given {k,n). That 
is, in this construction, the optimal underlying QSS scheme is 
that with the unique access structure that both saturates the no- 
cloning bound (we will refer to such schemes as "boundary" 
schemes) and satisfies (|6]l. For an initial (fc,n) boundary 
scheme, then, the optimal underlying QSS scheme will simply 
have a {kq = k,nq = n) structure. Hence the construction 
of Lemma [T] can only reduce the number of quantum shares 



3 




(6,7) CSS 



Fig. 1. An example (6,7) HQSS protocol. A quantum secret ip is encrypted 
to an EQS using a CK, then the EQS is split among the first 3 of 7 players 
using a (2,3) QSS and the CK among all 7 players using a (6,7) CSS. Any 
fewer than 6 players have no information about the CK, hence none about the 
secret. A subset of 6 or more players, however, can recover the CK and will 
also contain at least 2 of the 3 players with quantum shares, hence can also 
recover the EQS and decrypt to obtain the secret. Thus the overall scheme is 
a perfect (6,7) QSS scheme, but requiring only 3 quantum shares. 



for non-boundary threshold schemes. An example of such an 
HQSS scheme is shown in Figure [T] 

Assuming then that an optimal threshold QSS construction 
exists for the underlying {kq,nq) scheme with a secret of 
size ds (as is always the case f4l for prime dg > Uq), we 
can implement a {k,n) scheme with total dealer quantum 
communication, in qubits, of 

Qhqss = {in- 2k + l)\ogM- (7) 

All of the perfect hybrid schemes described in Q and later 
work by Singh and Srikanth fSl are based on distributing the 
EQS using perfect QSS, which reduces the number of quantum 
shares but not their individual sizes. In the next section we 
demonstrate that one may reduce both. 

IV. Hybrid ramp QSS schemes 

The above scheme combines perfect QSS and CSS schemes 
to create a perfect hybrid QSS. We note that, if one instead 
combines a ramp QSS scheme with a perfect CSS scheme, 
one can potentially also create a perfect hybrid ramp QSS 
(HRQSS) scheme, despite the presence of intermediate sets 
with respect to the underlying RQSS scheme. If the shares 
are distributed in such a way that any subset of players with 
partial information on the EQS has no information on the CK, 
then overall the subset has no information about the original 
secret and hence is forbidden. In this case there are no longer 
any intermediate sets and the scheme is perfect. 

To this end, the same general construction used in Lemma 
[T] can be used, but with a {kqr,Lqr,'i 



iqr 



) underlying RQSS 

instead of a {kq,nq) QSS. By the same reasoning as (|2]l we 
have the requirement 



kqj' ^ TTh 



k 



(8) 

< fc, and 

hence any intermediate subset of the RQSS will be forbidden 



Since clearly nqr < n, it follows from dSJ that k, 



qr 



with respect to the CK and hence the secret, as required. There 
is, however, one important difference from the previous case: 
Since gaining information about an unknown quantum state 
implies disturbance of that state llT3l . for any kqr players 
to have complete knowledge of the secret requires that the 
complementary sets of Uqr — kqr players have no knowledge 
of the secret. In a {kqr, Lqr,nqr) RQSS scheme a subset of 
more than kqr — Lqr players has some knowledge of the secret, 
hence we require for such a scheme that 



kqr kqr 



Lqr, thus 
Lfir • 



(9) 



Hence we cannot have nqr — 2kqr — 1 (except in the trivial 
Lqr = 1 case) and simply replace the underlying boundary 
QSS with an RQSS. Instead we must use an RQSS which, we 
will see, in general has more quantum shares than the QSS in 
our previous construction (though still fewer than a standard 
(fc, n) QSS), but the quantum shares are smaller. We find the 
following result: 

Theorem 2. One may construct a perfect (fc, n) threshold 
scheme with secret size logj dg qubits and nqr partly- or fully- 
quantum shares (where 2n~2k + l < nqr < n) with shares of 
%r qubits, for a total dealer quantum communication 



log2 



1-2 

cost, in qubits, of 



Qhqrss 



log2 dg 



(10) 



provided that an optimal {kqr, Lqr, nqr) RQSS exists for a 



{n — k) and Lqr 



secret of size dg, where kqr = n, 

Proof: An optimal {kqr, Lqr, nqr) RQSS protocol has 
share size log2 dg qubits, (we can always, though not 
exclusively, construct such protocols ||6l for shares of prime 
dimension > nqr). For given nqr, we wish to minimise 



Lqr 



L. 



> 



1 



qr 



2^ 



subject to (|9]l and (O. We can do this by setting 



Lqr — 2kqr 



{n — k) 

— nqr • 



(11) 



(12) 
(13) 



We therefore, as in the HQSS case, encrypt the secret using 
a CK of 2 log2 dg bits and distribute the CK among the 
players using a {k,n) threshold CSS scheme, then distribute 
the corresponding EQS among nqr of the players using an 
optimal {kqr, Lqr, nqr) RQSS scheme satisfying the above 
parameters. ■ 
As seen from ( fTOl l. the dealer's quantum communication 
cost Qhqrss decreases as nqr increases and hence is at its 
lowest when nqr — n i.e. when all n shares have a small 
quantum element of size (log2 dg)/nqr, in which case the total 
quantum communication cost is 

n log2 dg 



QminHQRSS 



2k- 



(14) 
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The minimum number of quantum shares (and hence the 
largest cost) occurs when n^r = 2n — 2fc + 1 and Lqr ~ 1 
i.e. the HQSS case of Lemma [T] with a cost given by O. In 
general, then, this scheme has a lower cost than the HQSS 
construction. 

Hence we have a range of possible protocols; we can use 
fewer, larger quantum shares (as would be suitable when e.g. 
many players can only process classical information) or more, 
smaller quantum shares (suitable when e.g. more players can 
process quantum information, but with small communication 
or storage capacities), with the latter option giving the smallest 
overall quantum system distributed by the dealer. 

V. Bounds on quantum and classical share size 

In our above constructions of perfect QSS schemes, in- 
volving both quantum and classical elements to the player 
shares, we have only considered optimisation with respect 
to the quantum communication cost. It is straightforward, 
however, to derive a joint bound on both quantum and classical 
share sizes, by a simple generalisation of the proof of the 
quantum share size bound given in |5| (since that bound was 
ultimately established by referring to classical communication 
cost), which we give below, using much of the same reasoning 
as 0. 

Theorem 3. A perfect QSS scheme sharing an arbitrary 
quantum secret of dimension dg requires shares with quantum 
elements of dimension dg and classical elements of dimension 
dc such that, for every important share (those which can affect 
whether or not a subset is authorised), 2 logj dg + logj dc > 
21og2 ds. 

Proof: As shown in |5|, if an arbitrary d-dimensional 
quantum secret ip is encoded into a state of n shares (j)pip2...p„, 
such that a subset of shares P can fully recover tp in the 
absence of any assistance from the complementary subset 
P, then the subset P can also, without assistance, alter the 
secret t/j to a new arbitrary c?-dimensional state such that 
a recovery procedure that would originally have recovered ip 
will now recover ip'. 

Consider now a perfect pure-state QSS (i.e. the combined 
state of all players for a given secret is pure), for a dg- 
dimensional secret tpds^ a forbidden subset of players F 
such that F can be made authorised by adding one additional 
player. For a perfect scheme, it is clear that such a subset 
must always exist (and can be found for any given player 
with an important share). Additionally, in a pure-state QSS, it 
is known |4| that the complement of any unauthorised subset 
is authorised, so the complementary subset F of F will be 
authorised. 

The subset F can therefore replace ipds with an arbitrai-y dg- 
dimensional secret tpd' ■ They can then choose an appropriate 
player pa and pass that player's share (which we will take 
to be a quantum share of dimension dg and a classical share 
of dimension dc, abbreviated {dg,dc)) to the subset F, such 
that the resultant subset Fpa will be authorised and able to 
recover the new secret ipd' ■ Consequently, this construction 
provides a mechanism to transfer an arbitrary quantum state 



il^d' of dimension dg between parties by transferring a share 
of dimension {dg,dc) (note though that this mechanism may 
require the parties to additionally share some pre-existing 
entanglement). Since any perfect mixed-state QSS can be 
represented as a perfect pure-state QSS with some shares dis- 
carded [4 1, mixed-state QSS schemes also imply the existence 
of such a mechanism. 

Consider now the case of two parties, Alice and Bob, who 
share a cat state J^'iLol'^) M^) b ■ By the simple generalisation of 
superdense coding ifHl . AUce may locally encode one of dg^ 
classical states into this state, and thus communicate 2 log2 dg 
classical bits to Bob by transferring her -dimensional half of 
the state to him. Hence if Alice and Bob possess appropriate 
states to make use of the QSS mechanism above, Alice can 
transfer to Bob a state of dimension {dq,dc) and thereby 
transfer a state of dimension dg and hence communicate 
2 log2 dg classical bits. 

However, it has been proven ifTsl that to communicate 
2 log2 d classic bits using quantum states, even in the presence 
of pre-existing entanglement, requires the communication of a 
quantum state of dimension > d. Hence transferring a quantum 
state of dimension dg can communicate at most 2 log2 dg 
bits. Since the entanglement-assisted classical capacity of a 
channel is additive (and the entanglement-assisted capacity of 
a perfect classical channel is simply its classical capacity) lfT6l . 
transferring a state dg and log2 dc classical bits can transfer at 
most 2 log2 dg + log2 dc bits. Hence communicating 2 log2 dg 
bits in total via this method (as we have shown can be achieved 
given the existence of a perfect QSS with this share size) 
requires that 

log2 dc + 2 log2 dg >2 log2 dg (15) 

and hence this bound must be satisfied by all important shares 
of any perfect QSS. ■ 
We require a CK of 2 log2 dg bits to classically encrypt a 
secret of size dg, and a perfect CSS requires classical share 
sizes log2 dc to be at least as large as the classical secret. 
Hence (since we clearly require dg > for a quantum secret), 
if using a hybrid construction in which the quantum secret is 
securely classically encrypted, we cannot saturate the bound 
( fTSl l using a perfect CSS. We show in the next section that, 
however, we can saturate this bound, and produce a perfect 
overall QSS, using a hybrid scheme in which both underlying 
QSS and CSS schemes are ramp schemes. 

VI. DOUBLY-RAMP OPTIMAL HRQSS 

Our construction for such a hybrid scheme will be much as 
before: encrypt the quantum secret using a CK, then distribute 
the EQS and CK using a QSS and CSS respectively. In general, 
however, if both underlying schemes are ramp schemes, certain 
subsets of players will be intermediate subsets with respect 
to both the EQS and CK i.e. they will have some partial 
information about both, and hence in general be able to 
construct some partial information about the secret, making 
the scheme imperfect. 

We find, though, that one can construct schemes which 
distribute the information in such a way that such subsets. 
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despite having partial information on both EQS and CK, have 
no information about the original quantum secret. Hence we 
can use both quantum and classical ramp schemes in a hybrid 
scheme, reducing the amount of classical communication 
required by the dealer and the size of the classical element 
of individual shares. 

We will describe such schemes as optimal if the size of 
the largest quantum share element is the smallest possible and 
all shares saturate the bound ( fTSl ) i.e. given the size of the 
quantum elements, the classical elements are also the smallest 
possible. (In our examples below, all of the quantum elements 
are of equal size, likewise the classical elements). 

A. (n, n) protocols 

A relatively simple example occurs for the (n, n) access 
structure, for which we find the following result: 

Theorem 4. One can construct an optimal perfect {n, n) 
hybrid threshold QSS encoding an n-qudit secret (where the 
qudits are of equal but arbitrary dimension). 

Proof: Separately encrypt each qudit qi using a 2-dit CK 
ki via the standard classical encryption protocol ([T]l. Distribute 
each encrypted qudit to a different player i, and distribute the 
corresponding Ki to the remaining n ~ 1 players using an 
(n — l,n — 1) threshold CSsQ. Thus n players will have all 
qudits and the corresponding CK for each qudit, hence be 
able to recover the secret. Any fewer than n players will, for 
any given q^, lack either the encrypted qudit and/or sufficient 
shares to have any information about the corresponding Ki, 
and hence have no information about the secret. 

The total quantum communication is simply the size of the 
secret and hence can be no smaller, and since every quantum 
share is of equal size, this also minimises the size of the 
largest quantum share. The share sizes (each player receives 
2 classical dits for n — 1 of the Ki for a total of 2(n — 1) 
dits and 1 qudit per share, for an n-qudit secret) saturate the 
bound [TSl hence the scheme is optimal. ■ 

We note that in the above construction (for which the 
(2,2) case with a 1-qubit secret is simply the teleportation 
scheme of [j3J), even though each individual CSS for a given 
CK Ki is perfect (as is the overall HRQSS), the overall 
CSS scheme for the complete CK (consisting of all Ki) is 
a (fc, L, n) = {n, 2, n) ramp scheme. Any set of rt — 2 players 
has no information about any Ki, while n — 1 players will 
have complete information about a single Ki and none about 
any of the others i.e. they will have partial information about 
the complete CK. Interestingly, the overall scheme is optimal 
despite this ramp CSS (RCSS) scheme not being optimal, in 
the sense that the classical share size of 2(n — 1) dits is greater 
than the secret size of 2n dits divided by L = 2. 

B. (n — l,n) protocols 

The (n, n) access structure allows for a relatively simple 
construction which does not readily extend to other access 

-An (n, n) CSS with a d-dimensional secret can be constructed using d- 
dimensional shares for any n and d, by randomly choosing the values of any 
n — 1 shares, and choosing the value of the final share such that summation 
of all the shares modulo d is equal to the secret. 



Structures. As discussed below, however, we have found a more 
complex approach which can be used to generate various cases 
of {n,n — 1) protocols. The underlying reasoning does share 
a common idea with the (n, n) protocol: since, as discussed 
above, we can perform a 2-bit classical encryption of a qubit 
(which can also be thought of as applying one of the four 
PauU operations {/, X, Y, Z} to that qubit at random), then we 
can construct a classical key for an encrypted multi-qubit state 
from the keys for the individual encrypted qubits. If the qubits 
and information about the key are distributed in an HRQSS 
such a way that a subset of players only receives classical 
information pertaining to the qubits they do not possess, then 
overall they have no information on the quantum secret. 

We first define the code space we will be be using for our 
underlying QSS scheme. Let \s;t) with {s,t} e {0, 1} be the 
2-qubit eigenstates satisfying 

X (^X\s;t) = {-iy\s;t), cind (16) 
Z(E)Z\s;t) = {-iy\s;t). (17) 

(These are also the four Bell states: |0,0) = |$+), |1,0) = 
1$-), |0, 1) = and |1,1) = l^--)). Define a state of 

n — 2m qubits 

|s;t) = |si;ii)® |s2;t2) «)••■«) |s,„;im) (18) 

where s = (si, S2, s™) and t = (fi, t2, t„i) are two 
sequences of m bits each. 

Consider now the stabiliser group Gs acting on n = 2m 
qubits, with two generators: 

= (19) 

Our code space C, in which we encode our quantum secret, 
will be the n-qubit subspace stabilised by Gg ■ It can easily be 
verified that g\s; t) = |s; t) for all four elements g e Gs if and 
only if X^fcLi — and X^feLi = (with all summations 
done mod 2 here and henceforth), thus we can write C as 

{m m \ 

|s;t) I ^Sfe = , ^ifc = ol . (20) 
fc=i fc=i J 

We see that this code can correct 1 erasure error: should a 
qubit go missing, the remaining players can replace it with a 
new qubit in some arbitrary state, then collectively measure 
the values of the stabilisers X^" and Z**" on the new set 
of n qubits, projecting the state back into the code space up 
to an error on the replacement qubit. Any error (indicated by 
the measured stabiliser values) can be corrected by applying 
a Z and/or X operation to the new qubit, thus recovering the 
original state. 

We wish to classically encrypt our encoded secret within 
this code space, and so introduce further notation to describe 
our classical encryption. Denote the four Pauli operations by 
Bpq (p, q G {0, 1}) as follows: 

^00 = I, Bqi = X, Bio = Z Bii = ZX = —iY. 

(21) 

Then the 2-qubit states \s,t) satisfy 

B„(^I\s-t) = {~lY'i\s+p-t + q) (22) 
I®Bj,q\s-t) = (-l)P(«+*)|s+p;t + 9). (23) 
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Given two n-bit strings p = {pi,p2, ■■■,Pn) and q = 
((71,(72, ...,(?„), we denote 

-Bpq = Spigi Bp252 ® • • • (g) Bp„g„ . (24) 

It follows from (|2l, (|22li and (|23]l that Bpq\ip) G C for all 
lip) e C if and only if Y.k=i Pk = LLi Ik = 0. 

Consider now a quantum secret jV'} G C- The dealer picks, 
with uniform probability, two n-bit strings p = {pi,p2, ■■■,Pn) 
and q = (gi, (72, ^n) (to remain within the code space, 
we require that J2k=iPk — J2k=i1k = 0' thus there are 
only 2^("~^) possibilities for the two strings) and applies the 
operator Bpq to produce the EQS 

IV-pq) = Bpql^)- (25) 

Note also, however, that the stabiliser generators X®" and 
Z®" (which leave the secret unchanged) can be expressed as 
operators i?p'q', and that, up to an irrelevant overall phase, 
products of B operators are B operators themselves i.e. 

BpqBp'q' = ±B(p+p/)(q+q,). (26) 

Thus, up to an overall phase, there are four equivalent op- 
erators Bpq for a given transformation of the secret (the 
original i?pq combined with one, both, or neither of the two 
stabiHser generators), for a total of 22("-i)-2 = 22("-2) 
distinct transformations of the secret. Hence our CK consists 
of 2{n — 2) bits of information, as is required for an {n — 2)- 
qubit secret. Similarly, defining p = (pi + l,p2 + l, • • ■ ,Pn + l) 
and similarly for q we have that 

IV-pq) = ±|V^pq) ^ il^Apq) = ij^Apq) ■ (27) 

The dealer distributes the EQS by sending each player a 
qubit; since the EQS is within the code space, any n — 1 
players will be able to recover it. The overall quantum secret 
is of size n — 2 qubits and each player receives 1 qubit, thus 
the scheme is optimal with respect to the quantum share size 
(since player shares are the smallest possible quantum system: 
1 qubit). From the share size bound for perfect QSS schemes 
it is implicitly clear that the distribution of the EQS constitutes 
an RQSS (since the quantum shares are smaller than the EQS). 

To have an optimal overall HRQSS scheme for this quantum 
secret we see from ( fTSl l that the classical share size must be 
2((n — 2) — 1) = 2{n ~ 3) bits. We therefore require an 
RCSS scheme distributing the the 2{n — 2) classical bits of 
information in the CK (strings p and q, up to the equivalency 
relations discussed above which mean that the strings are each 
n bits long but carry n — 2 bits of information about the EQS) 
to the players using shares of this size. A convenient feature 
of our construction is that a scheme which works for one of 
p and q can also be used to distribute the other, so we will 
consider only a scheme for distributing the information in p, 
with each player receiving n — 3 bits. 

We now describe, in terms of the distribution of p, the 
classical schemes we have found for specific player numbers 
n. These are all of the form that subsets of n — 1 players 
receive complete information (as required), those of n — 2 
players receive one (useless) bit of information on the CK, and 
fewer than n—2 players receive no information. For a subset of 



Player 1 


Xl 


yi 


X2 + X3 + ys + yi + Pi + PS 


Player 2 


X2 


J/2 


X3 + X4 + y4 + ys + ps + pi 


Player 3 


^3 


ys 


Xi + X5 + ys + yc + PC + pi 


Player 4 


X4 


yi 


X5 + xa + ya + yi + pi + PS 


Player 5 


X5 


ys 


X(i + xi+yi+y2+P2+ PS 


Player 6 


xa 


ye 


+ X2 + y2 + ys + P3 + P5 



TABLE I 

Listing of bits received by players in the 6-player RCSS scheme 



players to possess useful classical information on the quantum 
secret, they must have some information corresponding to the 
qubits they also possess (e.g. a subset of players 1,2 and 3 must 
have some information on the bits pi, p2 and/or p^. Note that 
since J^k Pk = 0' knowing the complement of such bits can 
provide such information (e.g. if there were 4 bits in total, 
knowing p^ + pi would also give p2 + ps). 

1) 4 players: In this case the dealer generates a single 
additional random bit z, and distributes to each player k the 
bit Pa[k) + z using the permutation 

/ 1 2 3 4 \ 
cr = . (28) 

\^ 1 4 2 3 y 

so e.g. player 1 receives pi + z, player 2 receives p4 + z etc. 
Since they do not know z, no player alone has any information 
on the secret p. Since pk — and Az ~ mod 2, 3 players 
know that the missing player's bit is equal to the sum of their 
bits, and can thus determine all 4 bits (not knowing z, they 
could have either p or p but these are equivalent as per ( |27l ). 

Two players can find out +Pa{j) = P5-a{i} +Pb^a(jy 
but the construction of a is such that no pair {a{i),a{i)) is 
or (5 — z,5 — i) for any i ^ j. E.g. players 1 and 
4 can obtain pi + P4 = P2 + Ps but since they only possess 
qubits 1 and 2 this gives no overall information on the quantum 
secret. Thus by applying this scheme to the distribution of p 
and q (with independently generated values of z for each) we 
produce an optimal (3, 4) HRQSS. 

2) 6 players: For 6 players the classical secret size (for p 
alone) is n — 2 = 4 bits, and each player receives n — 3 = 3 
bits of information. The dealer generates additional random 
valuables xi,X2, ■ ■ ■ ,xe and j/i, ?/2, • ■ • , 2/6, requmng that 

6 

^:Ez = (29) 

(but with no such constraint on the yi). Each player k receives 
the following 3 bits: Xk, Vk and 

Sk = Xk+l + Xk+2 + Vk+2 + Vk+Z +Pk+Z 

+ {pk-1 (if k even) or pk-2 (if k odd)). (30) 

The complete set of received bits is given in Table |T] We 
now consider key examples, which suffice to show the scheme 
works in all cases. 

a) Example 1: 4 adjacent players: If players 1,2,3 and 4 
collaborate, they know Xi to X/^ and j/i to 1/4 and can subtract 
these (and the complement +2:6 = xi+X2 + xj, + xa, using 
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(|29] l from their bits, leaving knowledge of: 

1 :p4 + P5 

2 +P5+P1 

3 :a:^5 + 2/5 + ye + + Pi 

4 -yG+Pi +P3- 

Variable j/g appears only in bit 4, so cannot be eliminated, 
making bit 4 useless to the players. The same occurs with 
2:5 (since does not appear) and bit 3. With bits 3 and 4 
excluded, 1/5 appears only in bit 2, rendering it useless, and 
the only information the players have is the value of p4 +p5 = 
Pi + P2 + P3 + Pe, which doesn't help them since they don't 
have qubit 5 or qubit 6. 

If instead we have players 2 to 5 (we require a second 
example due to the odd/even dependence in the distributed 
bits), they know the corresponding x and y values and hence 
from their Sk bits they know: 

2 :P5 + Pi 

3 -yG+PG +Pi 

4 :X6 + j/6 + 2/1 +P1+P3 

5 -yi +P2 + Pa- 
Bit 4 is useless due to xq, making bits 3 and 5 also useless 
due to 2/6 and 2/1 respectively and leaving the players with only 
P5+P1 = P2+P3+P4+P6^ but lacking qubits 1 or 6 means the 
players have no knowledge of the secret. By cyclic permutation 
these examples cover all cases of 4 adjacent players. 

b) Example 2: 4 players, 3 adjacent: If players 1,2,3 and 
5 collaborate, by analogous reasoning to the above they know: 

1 :2/4 +P4+P5 

2 -.Xi + 2/4 + Pb + Pi 

3 -.Xi + y6+P6+Pi 

5 :xe +P2+P3 

Bit 3 is useless due to y^. The players can sum bits 2 and 5 and 
eUminate X4 + XQ — X1+X2+X3+X5 to get yA+Pi+P2+P3 + 
P5, then sum with bit 1 to get pi +p2 +P3 +P4 = P5 +P6 which 
is their only bit of information, and useless without qubits 4 
or 6. 

If players 2,3,4 and 6 collaborate they know from their 
additional bits: 

2 :2/5 +P5+P1 

3 :a:;5 + 2/5 + Pe + Pi 

4 :x5 + yi + Pi + P3 

6 :xi +P3+P5 

Bit 4 is useless due to 2/1. Eliminating 2/5 between bits 1 and 
2 gives 2:5 +P5 +pe, then eliminating 2:5 +a;i with bit 6 gives 
Pi +P3 — P2 +P2 +P5 +P6, useless without qubits 3 or 5. By 
cyclic permutation these examples cover all cases of 4 players 
with 3 adjacent. 



c) Example 3: 4 players, 2 adjacent: If players 1,2,4 and 
5 collaborate they have 

1 ■X3 + y3+P4+P5 

2 :X3 +P5+P1 

4 :xe + y6+Pi+P3 

5 :X6 +P2+P3 

Bits 1 and 4 are useless due to 2/3 and y^. EUminating X3 +xq 
between bits 2 and 4 gives pi +p2 +P3 +P5 = P4 +P6^ useless 
without qubits 3 or 6. 

If players 2,3, 5 and 6 collaborate they have 

2 :x4 + yi + P5 + pi 

3 :x4 +P6+P1 

4 :yi +P1+P3 

6 :xi +P3+P5 

Bits 2 and 4 are useless due to 2/4 and yi. Eliminating X4 + X1 
between bits 3 and 6 gives pi + P3 + P5 + pe — P2 + Pa, 
useless without qubits 1 or 4. Cyclic permutation of the above 
examples covers all remaining cases, thus we have shown that 
no set of 4 players has any information on the quantum secret. 

We still need to show that 5 players can recover all 4 bits of 
the classical secret, for which it is sufficient to show that they 
obtain 4 independent bits of information about the string p. 
Suppose players 1 to 5 collaborate. Using ( |29] | they know all 
values of Xk and all yk except 2/6- They therefore have access 
to the bits pi +p5, 2/6 +P& +Pi, 2/6 +Pi +P3, P2 +P3 

and Pa + P5 . Eliminating y^ between the two bits containing it 
gives them access to the 4 independent bits p^ +P5, P5 +pi. 
Pa +P6 ™d p2 +P3. If players 2 to 6 collaborate, they have 
access to p^ +pr„ P5 +Pi, Pe +Pi, yi +Pi +P3. 2/i +P2 +P3 
and P3+P5, and can obtain 4 independent bits P4+P5, P5+P1, 
Pq + pi and pi + p2- Other cases are covered through cyclic 
permutation. Hence all subsets of 5 players can recover the 
secret. 

We have therefore demonstrated optimal (3,4) and (5,6) 
HRQSS schemes. We conjecture that one can construct such 
{n — l,n) schemes for 2n qubits for any value of n, however 
we note that the relative advantage in doing so decreases as n 
gets large: our ramp classical share size of 2{n — 3) classical 
bits, while optimal for the HRQSS, is only 2 bits less than the 
lower bound for a perfect CSS scheme. Thus the (3, 4) case 
is arguably the most important example, since the classical 
shares are half of what an optimal perfect CSS scheme would 
require in this case. 

More significantly, this method of construction for HRQSS 
schemes holds great promise for adapting other QECCs from 
the wide class of stabiliser codes. By exploiting the structure of 
the underlying code and formulating the CSS element in terms 
of Pauli transformations on individual qubits, we reduced the 
problem to a purely classical one of constructing a suitable 
matching RCSS scheme for the underlying QSS scheme (we 
note that we are not aware of our particular RCSS schemes 
having appeared previously in the literature), for which we 
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can use two separate, identical schemes for the strings p 
and q, further simpUfying the problem. The properties of the 
HRQSS could be established purely classically, without having 
to generate density matrices for the combined classical and 
quantum information for the various player subsets. Adopting 
this approach with other stabiliser codes should make finding 
additional HRQSS schemes much more straightforward. 



additional features to provide security against eavesdropping 
in secret distribution and/or recovery. This is another important 
direction for future work. 
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VII. Conclusion 

We have shown that one can produce perfect threshold 
QSS schemes with both quantum share sizes and total dealer 
quantum communication below what has previously been 
shown, for any allowable non-boundary threshold (fc, n) access 
structure (i.e. any scheme where n < 2k — 1). We have further 
shown {n, n) and (for specific values of n) {n — l,n) access 
structures for which one can optimise both the quantum and 
classical share size i.e. our protocol gives the smallest possible 
quantum shares and the smallest possible classical shares given 
the quantum share size. These protocols allow one to find an 
efficient scheme for situations where some variable number of 
players can process quantum information, and one's priorities 
may vary from minimising the total quantum communication 
to minimising the total number of quantum shares. 

These results suggest various directions for further work. 
Firstly, our optimal doubly-ramp schemes are currently only 
known for specific access structures; it would be very desirable 
to generalise this, and to know when and how an appropriate 
RCSS scheme can be constructed for a given RQSS in order 
to produce a perfect overall scheme. As discussed above, the 
approach used appears very promising for adapting to other 
stabiliser codes. We note that the RQSS schemes used do not 
fall under the general construction of ||6]; finding matching 
RCSS schemes for this construction would produce a wide 
range of optimal hybrid schemes. 

We further note that our doubly-ramp schemes can be seen 
to be optimal in the sense of having the smallest possible 
quantum shares only due to special circumstances: for the 
{n, n) schemes our total quantum communication is the size 
of the secret and for the [n — l,n) schemes the quantum 
shares have the smallest non-trivial dimension of 2. In general, 
however, we do not know what the smallest possible quantum 
shares are for a given perfect hybrid scheme, or indeed how 
large the overall quantum system communicated by the dealer 
must be, beyond the obvious lower bound of the secret size d^; 
finding a tight bound would be an important step to identifying 
optimal schemes. 

We have only addressed the application of hybrid ramp 
schemes to the construction of threshold schemes, rather than 
more general access structures. Some results on non-ramp 
hybridisation of such schemes were found in |7| and J8] and 
it seems likely that hybrid ramp schemes could reduce share 
sizes for these access structures as well. In general, though, 
little is currently known about non-threshold QRSS schemes. 

Fianlly we note, and thank an anonymous referee for point- 
ing out, that for HRQSS schemes to be useful in a practical 
insecure setting, without access to secure quantum channels 
between individual players and players and dealer, will require 
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